# SARE HTML Ruleset for SpamAssassin - ruleset 1
# Version: 01.03.10
# Created: 2004-03-31 
# Modified: 2006-06-03
# Usage instructions, documentation, and change history in 70_sare_html0.cf 

#@@# Revision History:  Full Revision History stored in 70_sare_html.log
#@@# 01.03.10: June 3 2006
#@@#           Minor score tweaks based on recent mass-checks
#@@#           Modified "rule has been moved" meta flags 
#@@#           Added to file 1      SARE_HTML_SINGLETS
#@@#           Archive:             SARE_HTML_ALT_WAIT1
#@@#           Archive:             SARE_HTML_A_NULL
#@@#           Archive:             SARE_HTML_H2_CLK
#@@#           Archive:             SARE_HTML_JSCRIPT_ENC
#@@#           Archive:             SARE_HTML_URI_BUG
#@@#           Moved file 1 to 2:   SARE_HTML_BR_MANY
#@@#           Moved file 1 to 2:   SARE_HTML_ONE_LINE2
#@@#           Moved file 1 to 2:   SARE_HTML_URI_OC
#@@#           Moved file 1 to 3:   SARE_HTML_TITLE_MNY
#@@#           Moved file 1 to 3:   SARE_HTML_URI_DEFASP  

# License: Artistic - see http://www.rulesemporium.com/license.txt 
# Current Maintainer: Bob Menschel - RMSA@Menschel.net
# Current Home: http://www.rulesemporium.com/rules/70_sare_html1.cf 

########  ######################   ##################################################
#         Rules renamed or moved
########  ######################   ##################################################

meta      __SARE_HEAD_FALSE        __FROM_AOL_COM && !__FROM_AOL_COM
meta      SARE_HTML_URI_RM         __SARE_HEAD_FALSE
meta      SARE_HTML_URI_REFID      __SARE_HEAD_FALSE
meta      SARE_HTML_ALT_WAIT1      __SARE_HEAD_FALSE
meta      SARE_HTML_A_NULL         __SARE_HEAD_FALSE
meta      SARE_HTML_H2_CLK         __SARE_HEAD_FALSE
meta      SARE_HTML_JSCRIPT_ENC    __SARE_HEAD_FALSE
meta      SARE_HTML_URI_BUG        __SARE_HEAD_FALSE
meta      SARE_HTML_BR_MANY        __SARE_HEAD_FALSE
meta      SARE_HTML_ONE_LINE2      __SARE_HEAD_FALSE
meta      SARE_HTML_URI_OC         __SARE_HEAD_FALSE
meta      SARE_HTML_TITLE_MNY      __SARE_HEAD_FALSE
meta      SARE_HTML_URI_DEFASP     __SARE_HEAD_FALSE

########  ######################   ##################################################

header    __CTYPE_HTML             Content-Type =~ /text\/html/i

rawbody   __SARE_HTML_HAS_A        eval:html_tag_exists('a')
rawbody   __SARE_HTML_HAS_BR       eval:html_tag_exists('br')
rawbody   __SARE_HTML_HAS_DIV      eval:html_tag_exists('div')
rawbody   __SARE_HTML_HAS_FONT     eval:html_tag_exists('font')
rawbody   __SARE_HTML_HAS_IMG      eval:html_tag_exists('img')
rawbody   __SARE_HTML_HAS_P        eval:html_tag_exists('p')
rawbody   __SARE_HTML_HAS_PRE      eval:html_tag_exists('pre')
rawbody   __SARE_HTML_HAS_TITLE    eval:html_tag_exists('title')

rawbody   __SARE_HTML_HBODY        m'<html><body>'i
rawbody   __SARE_HTML_BEHTML       m'<body></html>'i
rawbody   __SARE_HTML_BEHTML2      m'^</?body></html>'i
rawbody   __SARE_HTML_EFONT        m'^</font>'i
rawbody   __SARE_HTML_EHEB         m'^</html></body>'i
rawbody   __SARE_HTML_CMT_CNTR     /<center><!--/

# JH: These rules test for strange color combinations. There migth be even more powerful combinations, but I haven't had time to check them all
rawbody   __SARE_LIGHT_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!fff\W|ffffff)(?:[e-f]{3}\W|(?:[e-f][0-9a-f]){3})|rgb(?:\((?!\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255)\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10}\)|\((?!\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%)\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10}\))|(?:Light(?:Cyan|Yellow)|(?:Ghost|Floral)White|WhiteSmoke|LemonChiffon|AliceBlue|Cornsilk|Seashell|Honeydew|Azure|MintCream|Snow|Ivory|OldLace|LavenderBlush|Linen|MistyRose))/i
rawbody   __SARE_WHITE_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:fff\W|ffffff)|rgb(?:\(\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255\s{0,10}\)|\\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10}\))|white)/i
rawbody   __SARE_DARK_FG_COLOR     /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!000\W|000000)(?:[01]{3}\W|(?:[01][0-9a-f]){3})|rgb(?:\((?!\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\D)\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10}\)|\((?!\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%)\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10}\)))/i
rawbody   __SARE_BLACK_FG_COLOR    /[^\-a-z]color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:000\W|000000)|rgb\s{0,10}\(\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\s{0,10}\)|rgb\s{0,10}\(\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10}\)|black)/i
rawbody   __SARE_LIGHT_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!ffffff|fff\W)(?:[e-f]{3}\W|(?:[e-f][0-9a-f]){3})|rgb(?:\((?!\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255)\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10},\s{0,10}2[2-5][0-9]\s{0,10}\)|\((?!\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%)\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10},\s{0,10}(?:100|9[0-9]|8[6-9])\s{0,10}%\s{0,10}\))|(?:Light(?:Cyan|Yellow)|(?:Ghost|Floral)White|WhiteSmoke|LemonChiffon|AliceBlue|Cornsilk|Seashell|Honeydew|Azure|MintCream|Snow|Ivory|OldLace|LavenderBlush|Linen|MistyRose))/i
rawbody   __SARE_WHITE_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:fff\W|ffffff)|rgb(?:\(\s{0,10}255\s{0,10},\s{0,10}255\s{0,10},\s{0,10}255\s{0,10}\)|\(\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10},\s{0,10}100\s{0,10}%\s{0,10}\))|white)/i
rawbody   __SARE_DARK_BG_COLOR     /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?!000\W|000000)(?:[01]{3}\W|(?:[01][0-9a-f]){3})|rgb(?:\((?!\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\D)\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10},\s{0,10}[0-3]?[0-9]\s{0,10}\)|\((?!\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%)\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10},\s{0,10}(?:[1-3]?[0-9])\s{0,10}%\s{0,10}\)))/i
rawbody   __SARE_BLACK_BG_COLOR    /(?:bg|background\-)color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\"])(?:\#?(?!\#)(?:000\W|000000)|rgb\s{0,10}\(\s{0,10}0\s{0,10},\s{0,10}0\s{0,10},\s{0,10}0\s{0,10}\)|rgb\s{0,10}\(\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10},\s{0,10}0\s{0,10}%\s{0,10}\)|black)/i
rawbody   __SARE_HAS_BG_COLOR      /(?:bg|background\-)color\s{0,10}(?::|=)/i
rawbody   __SARE_HAS_FG_COLOR      /[^\-a-z]color\s{0,10}(?::|=)/i

########  ######################   ##################################################
#   Is there a message? 
########  ######################   ##################################################

########  ######################   ##################################################
#   <HTML> and <BODY> tag spamsign
########  ######################   ##################################################

full      SARE_HTML_HTML_QUOT      /<HTML>.{0,2}&quot;/is
describe  SARE_HTML_HTML_QUOT      Message body has very strange HTML sequence
score     SARE_HTML_HTML_QUOT      1.666
#ham      SARE_HTML_HTML_QUOT      verified (2)
#hist     SARE_HTML_HTML_QUOT      Fred T: FR_HTML_QUOTE
#counts   SARE_HTML_HTML_QUOT      197s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_HTML_QUOT      236s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_HTML_QUOT      23s/0h of 9991 corpus (5656s/4335h AxB) 05/14/06
#counts   SARE_HTML_HTML_QUOT      16s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#counts   SARE_HTML_HTML_QUOT      82s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_HTML_QUOT      38s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_HTML_QUOT      159s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_HTML_QUOT      5s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_HTML_QUOT      98s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#counts   SARE_HTML_HTML_QUOT      0s/0h of 4676 corpus (808s/3868h ft) 05/28/05

full      SARE_HTML_HTML_TBL       /<html>.{0,2}<table/is
describe  SARE_HTML_HTML_TBL       Message body has very strange HTML sequence
score     SARE_HTML_HTML_TBL       0.646
#hist     SARE_HTML_HTML_TBL       Fred T: FR_HTML_TABLE
#counts   SARE_HTML_HTML_TBL       94s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_HTML_TBL       287s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_HTML_TBL       10s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_HTML_TBL       10s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#counts   SARE_HTML_HTML_TBL       3s/3h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_HTML_TBL       11s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_HTML_TBL       140s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_HTML_TBL       22s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_HTML_TBL       13s/3h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_HTML_TBL       30s/3h of 57287 corpus (52272s/5015h MY) 09/22/05

########  ######################   ##################################################
#   <TITLE> Tag Tests
########  ######################   ##################################################

rawbody   SARE_HTML_TITLE_1WD      m'^<title>[a-z]+</title>$'  
describe  SARE_HTML_TITLE_1WD      strange document title
score     SARE_HTML_TITLE_1WD      1.591
#hist     SARE_HTML_TITLE_1WD      Loren Wilton LW_FUNNY_TITLE
#counts   SARE_HTML_TITLE_1WD      1125s/4h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_TITLE_1WD      2076s/18h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HTML_TITLE_1WD      34s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_TITLE_1WD      105s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_TITLE_1WD      143s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#counts   SARE_HTML_TITLE_1WD      0s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#max      SARE_HTML_TITLE_1WD      1s/0h of 4676 corpus (808s/3868h ft) 05/28/05
#counts   SARE_HTML_TITLE_1WD      123s/2h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_TITLE_1WD      174s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_TITLE_1WD      53s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_TITLE_1WD      151s/1h of 47221 corpus (42968s/4253h MY) 06/18/05

rawbody   SARE_HTML_TITLE_2WD      m'^<title>[a-z]+\s[a-z]+</title>$'        # no /i
score     SARE_HTML_TITLE_2WD      0.660
describe  SARE_HTML_TITLE_2WD      strange document title
#hist     SARE_HTML_TITLE_2WD      Loren Wilton LW_FUNNY_TITLE1
#counts   SARE_HTML_TITLE_2WD      85s/7h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_TITLE_2WD      314s/9h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HTML_TITLE_2WD      18s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_TITLE_2WD      14s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_TITLE_2WD      15s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_TITLE_2WD      6s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_TITLE_2WD      19s/1h of 54089 corpus (16916s/37173h JH-3.01) 02/25/05
#counts   SARE_HTML_TITLE_2WD      29s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_TITLE_2WD      18s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_TITLE_2WD      40s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

rawbody   SARE_HTML_TITLE_DAY      /<title>(monday|tuesday|wednesday|thursday|friday)<\/title>/i
describe  SARE_HTML_TITLE_DAY      HTML contains day of week in title
score     SARE_HTML_TITLE_DAY      1.081
#hist     SARE_HTML_TITLE_DAY      Tim Jackson, May 12 2005
#counts   SARE_HTML_TITLE_DAY      184s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#counts   SARE_HTML_TITLE_DAY      2s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_TITLE_DAY      0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_TITLE_DAY      25s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_TITLE_DAY      2s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_TITLE_DAY      1s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_TITLE_DAY      16s/1h of 57287 corpus (52272s/5015h MY) 09/22/05

rawbody   SARE_HTML_TITLE_LWORD    /<title>[a-zA-Z]{15,}<\/title>/i
describe  SARE_HTML_TITLE_LWORD    HTML Title contains looong word
score     SARE_HTML_TITLE_LWORD    0.665
#ham      SARE_HTML_TITLE_LWORD    Rite Aid Single Check Rebates <rebates@rebates.riteaid.com>
#counts   SARE_HTML_TITLE_LWORD    485s/31h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_TITLE_LWORD    732s/40h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HTML_TITLE_LWORD    42s/1h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_TITLE_LWORD    3s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_TITLE_LWORD    3s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_TITLE_LWORD    4s/3h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_TITLE_LWORD    32s/1h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_TITLE_LWORD    161s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_TITLE_LWORD    84s/4h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_TITLE_LWORD    202s/1h of 47221 corpus (42968s/4253h MY) 06/18/05

rawbody   SARE_HTML_TITLE_SEX      /<title>.{0,15}\bSex.{0,15}<\/title>/i
score     SARE_HTML_TITLE_SEX      0.689
#ham      SARE_HTML_TITLE_SEX      confirmed (2) 
#hist     SARE_HTML_TITLE_SEX      Fred T: FR_TITLE_SEX
#counts   SARE_HTML_TITLE_SEX      4s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_TITLE_SEX      167s/2h of 196681 corpus (96193s/100488h RM) 02/22/05
#counts   SARE_HTML_TITLE_SEX      1s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_TITLE_SEX      0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_TITLE_SEX      7s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
#counts   SARE_HTML_TITLE_SEX      7s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_TITLE_SEX      5s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_TITLE_SEX      14s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_TITLE_SEX      1s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_TITLE_SEX      6s/0h of 23074 corpus (17350s/5724h MY) 05/14/06

########  ######################   ##################################################
#   <A> and HREF rules          
########  ######################   ##################################################

full      SARE_HTML_A_BODY         /(?!<body>\n\n<a href)<body>.{0,4}<a href/is
describe  SARE_HTML_A_BODY         Message body has very strange HTML sequence
score     SARE_HTML_A_BODY         0.742
#hist     SARE_HTML_A_BODY         Fred T: FR_BODY_AHREF
#counts   SARE_HTML_A_BODY         419s/2h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_A_BODY         1527s/18h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HTML_A_BODY         20s/1h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_A_BODY         2s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_A_BODY         92s/3h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_A_BODY         30s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_A_BODY         359s/25h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_A_BODY         134s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_A_BODY         10s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_A_BODY         50s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

########  ######################   ##################################################
#   Spamsign character sets and fonts 
########  ######################   ##################################################

rawbody   SARE_HTML_FONT_EBEF      m'</body></font>'i
describe  SARE_HTML_FONT_EBEF      Message body has very strange HTML sequence
score     SARE_HTML_FONT_EBEF      0.658
#ham      SARE_HTML_FONT_EBEF      verified (1) 
#hist     SARE_HTML_FONT_EBEF      Fred T: FR_BODY_FONT
#counts   SARE_HTML_FONT_EBEF      0s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_FONT_EBEF      44s/1h of 281655 corpus (110173s/171482h RM) 05/05/05
#counts   SARE_HTML_FONT_EBEF      36s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_FONT_EBEF      123s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_FONT_EBEF      1s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_FONT_EBEF      50s/1h of 31513 corpus (27912s/3601h MY) 03/09/05
#counts   SARE_HTML_FONT_EBEF      0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05

rawbody   SARE_HTML_FONT_SPL       /^\#[a-z0-9]{6}>/i    
describe  SARE_HTML_FONT_SPL       Message uses suspicious font size and/or color
score     SARE_HTML_FONT_SPL       0.650
#ham      SARE_HTML_FONT_SPL       verified (1)
#hist     SARE_HTML_FONT_SPL       Charles Gregory 
#overlap  SARE_HTML_FONT_SPL       Overlaps strongly with SARE_HTML_A_INV, though there's no regex overlap
#overlap  SARE_HTML_FONT_SPL       Overlaps strongly with SARE_HTML_FONT_SPLIT for obvious reasons, but not enough to warrant dropping one.
#counts   SARE_HTML_FONT_SPL       3s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_FONT_SPL       360s/0h of 85073 corpus (62478s/22595h RM) 06/07/04
#counts   SARE_HTML_FONT_SPL       5s/0h of 9991 corpus (5656s/4335h AxB) 05/14/06
#counts   SARE_HTML_FONT_SPL       1s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_FONT_SPL       14s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
#counts   SARE_HTML_FONT_SPL       5s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_FONT_SPL       53s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_FONT_SPL       3s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_FONT_SPL       0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_FONT_SPL       1s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

########  ######################   ##################################################
#   Invalid or Suspicious URI Tests
########  ######################   ##################################################

rawbody   SARE_HTML_URI_ESCWWW     /(?:%77w%77|w%77%77|%77%77w)/i
describe  SARE_HTML_URI_ESCWWW     URI with obfuscated destination 
score     SARE_HTML_URI_ESCWWW     2.222
#hist     SARE_HTML_URI_ESCWWW     Fred T: FR_ESCAPE_WWW
#overlap  SARE_HTML_URI_ESCWWW     Overlaps with SARE_HTML_FSIZE_1ALL
#counts   SARE_HTML_URI_ESCWWW     2572s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#counts   SARE_HTML_URI_ESCWWW     16s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_URI_ESCWWW     0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_URI_ESCWWW     3s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
#counts   SARE_HTML_URI_ESCWWW     117s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_URI_ESCWWW     0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_ESCWWW     16s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_ESCWWW     70s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_URI_ESCWWW     0s/0h of 47221 corpus (42968s/4253h MY) 06/18/05
#max      SARE_HTML_URI_ESCWWW     1s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

uri       SARE_HTML_URI_LHOST30    m*^https?://[a-z0-9]{30}\.*i
describe  SARE_HTML_URI_LHOST30    Long unbroken string within URI
score     SARE_HTML_URI_LHOST30    1.666
#hist     SARE_HTML_URI_LHOST30    Fred T (originally 40,)
#ham      SARE_HTML_URI_LHOST30    30: www.rebuildingthevillagefoundation.org
#counts   SARE_HTML_URI_LHOST30    301s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#counts   SARE_HTML_URI_LHOST30    18s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_URI_LHOST30    6s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#counts   SARE_HTML_URI_LHOST30    27s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_URI_LHOST30    0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_LHOST30    3s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_LHOST30    128s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_URI_LHOST30    5s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_URI_LHOST30    13s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

uri       SARE_HTML_URI_LHOST31    m*^https?://[a-z0-9]{31,}\.*i
describe  SARE_HTML_URI_LHOST31    Long unbroken string within URI
score     SARE_HTML_URI_LHOST31    1.666
#hist     SARE_HTML_URI_LHOST31    Fred T (originally 40,)
#ham      SARE_HTML_URI_LHOST31    30: www.rebuildingthevillagefoundation.org
#counts   SARE_HTML_URI_LHOST31    776s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_URI_LHOST31    840s/15h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HTML_URI_LHOST31    90s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_URI_LHOST31    99s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#counts   SARE_HTML_URI_LHOST31    125s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_URI_LHOST31    456s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_URI_LHOST31    94s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#counts   SARE_HTML_URI_LHOST31    21s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05

uri       SARE_HTML_URI_NOMORE     m'/nomore\.htm'i
describe  SARE_HTML_URI_NOMORE     URI to page name which suggests spammer's page
score     SARE_HTML_URI_NOMORE     0.906
#ham      SARE_HTML_URI_NOMORE     http://www.afsc.org/nomore.htm; Student Peace Action Network (SPAN)
#counts   SARE_HTML_URI_NOMORE     2s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_URI_NOMORE     1200s/0h of 92209 corpus (74874s/17335h RM) 01/17/04
#counts   SARE_HTML_URI_NOMORE     7s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_URI_NOMORE     0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_URI_NOMORE     69s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_URI_NOMORE     54s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_NOMORE     68s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_NOMORE     0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_URI_NOMORE     4s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

uri       SARE_HTML_URI_OUTPHP     /\bout\.php/i
describe  SARE_HTML_URI_OUTPHP     text uri to unsubscribe link
score     SARE_HTML_URI_OUTPHP     0.907
#addsto   SARE_HTML_URI_OUTPHP     SARE_HTML_URI_OPTPHP
#ham      SARE_HTML_URI_OUTPHP     Bravenet ad attached to reply form email
#counts   SARE_HTML_URI_OUTPHP     80s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_URI_OUTPHP     144s/2h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HTML_URI_OUTPHP     88s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_URI_OUTPHP     10s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_URI_OUTPHP     21s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
#counts   SARE_HTML_URI_OUTPHP     4s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_URI_OUTPHP     13s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_OUTPHP     25s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_OUTPHP     58s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_URI_OUTPHP     0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_URI_OUTPHP     17s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

uri       SARE_HTML_URI_PARTID     m|/[\?\&]partid=|i
describe  SARE_HTML_URI_PARTID     Partner Id in URL
score     SARE_HTML_URI_PARTID     0.166
#hist     SARE_HTML_URI_PARTID     Loren Wilton <lwilton@earthlink.net>, Sat, 3 Apr 2004 20:29:32 -0800
#counts   SARE_HTML_URI_PARTID     0s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_URI_PARTID     1264s/0h of 85073 corpus (62478s/22595h RM) 06/07/04
#counts   SARE_HTML_URI_PARTID     0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_URI_PARTID     37s/0h of 6944 corpus (3188s/3756h CT) 05/19/04
#counts   SARE_HTML_URI_PARTID     81s/6h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_URI_PARTID     302s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_URI_PARTID     3s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_URI_PARTID     26s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

########  ######################   ##################################################
#  <!-- Comment tag tests
########  ######################   ##################################################

meta      SARE_HTML_CMT_CNTR       __SARE_HTML_CMT_CNTR
describe  SARE_HTML_CMT_CNTR       Message has a center followed by a comment
score     SARE_HTML_CMT_CNTR       0.676
#hist     SARE_HTML_CMT_CNTR       Carl F: CRM_CENTER_COM
#ham      SARE_HTML_CMT_CNTR       Strategic Developer <strategicdeveloper@newsletter.infoworld.com>, Thursday, January 27, 2005, 10:57:37 AM  
#counts   SARE_HTML_CMT_CNTR       9s/2h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_CMT_CNTR       173s/7h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HTML_CMT_CNTR       1s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_CMT_CNTR       53s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_CMT_CNTR       196s/0h of 32260 corpus (8983s/23277h JH) 05/14/04
#counts   SARE_HTML_CMT_CNTR       2s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_CMT_CNTR       21s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
#counts   SARE_HTML_CMT_CNTR       1s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_CMT_CNTR       0s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#max      SARE_HTML_CMT_CNTR       7s/0h of 6944 corpus (3188s/3756h CT) 05/19/04

########  ######################   ##################################################
#   Image tag tests
########  ######################   ##################################################

rawbody   SARE_HTML_IMG_2AT        /IMG\s*SRC\s*=s*"cid:part1\.\d{8}.\d{8}\@[a-z]+\@[\w\.]+"/is
describe  SARE_HTML_IMG_2AT        strange internal image link
score     SARE_HTML_IMG_2AT        1.216
#hist     SARE_HTML_IMG_2AT        Loren Wilton: LW_DOUBLE_AT
#hist     SARE_HTML_IMG_2AT        Apr 2 2005, Bob Menschel, Added spaces around "="
#hist     SARE_HTML_IMG_2AT        Apr 16 2005, Bob Menschel, replaced spaces with \s
#counts   SARE_HTML_IMG_2AT        328s/13h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_IMG_2AT        3648s/4h of 689155 corpus (348140s/341015h RM) 09/18/05
#counts   SARE_HTML_IMG_2AT        222s/0h of 9991 corpus (5656s/4335h AxB) 05/14/06
#counts   SARE_HTML_IMG_2AT        69s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#counts   SARE_HTML_IMG_2AT        828s/1h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_IMG_2AT        57s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_IMG_2AT        280s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_IMG_2AT        0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_IMG_2AT        105s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

########  ######################   ##################################################
#  <tag ... ALT= ...> tag tests
########  ######################   ##################################################

########  ######################   ##################################################
#   Javascript and object tests     
########  ######################   ##################################################

full      SARE_HTML_IMG_ONLY       m'<(?:html|body).{1,200}<a.{12,145}<img.{11,200}</(?:body|html)>'is
describe  SARE_HTML_IMG_ONLY       Short HTML msg, IMG and A HREF, maybe naught else
score     SARE_HTML_IMG_ONLY       1.666
#ham      SARE_HTML_IMG_ONLY       Verified (image-only ham)
#hist     SARE_HTML_IMG_ONLY       Originally Fred T: FVGT_m_IMAGE_ONLY
#hist     SARE_HTML_IMG_ONLY       Enhanced May 29 2004 by Bob Menschel, incorporate all tests in one regex
#ham      SARE_HTML_IMG_ONLY       5: Oct 2002 Yahoo webmail with automatically inserted FAULTY flamingtext.com advertisement
#overlap  SARE_HTML_IMG_ONLY       Rules that completely overlap this one: SARE_HTML_PILL3, SARE_HTML_PILL4
#counts   SARE_HTML_IMG_ONLY       14904s/16h of 333405 corpus (262498s/70907h RM) 05/12/06
#counts   SARE_HTML_IMG_ONLY       70s/1h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_IMG_ONLY       154s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#counts   SARE_HTML_IMG_ONLY       4131s/6h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_IMG_ONLY       261s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_IMG_ONLY       553s/0h of 38858 corpus (15368s/23490h JH-SA3.0rc1) 08/22/04
#counts   SARE_HTML_IMG_ONLY       4730s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_IMG_ONLY       7s/7h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_IMG_ONLY       141s/0h of 26326 corpus (22886s/3440h MY) 02/15/05

rawbody   SARE_HTML_JVS_FLASH      m'codebase="https://download\.macromedia\.com/pub/shockwave'i
describe  SARE_HTML_JVS_FLASH      Tries to load flash animation 
score     SARE_HTML_JVS_FLASH      1.246
#ham      SARE_HTML_JVS_FLASH      verified (1) cbs.marketwatch.com
#hist     SARE_HTML_JVS_FLASH      Mike Kuentz <JunkEmail@rapidigm.com>
#counts   SARE_HTML_JVS_FLASH      444s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
#counts   SARE_HTML_JVS_FLASH      33s/0h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_JVS_FLASH      0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_JVS_FLASH      4s/0h of 11260 corpus (6568s/4692h CT) 06/17/05
#counts   SARE_HTML_JVS_FLASH      0s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#max      SARE_HTML_JVS_FLASH      7s/0h of 29366 corpus (5882s/23484h JH) 07/23/04 TM2 SA3.0-pre2
#counts   SARE_HTML_JVS_FLASH      53s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_JVS_FLASH      0s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_JVS_FLASH      28s/0h of 47221 corpus (42968s/4253h MY) 06/18/05

########  ######################   ##################################################
#  Obviously invalid html tag
########  ######################   ##################################################

header    __CT_TEXT_PLAIN          Content-Type =~ /^text\/plain\b/i
rawbody   __SARE_HTML_INV_TAG      /\w<\!\w{18,60}>\w/i
rawbody   __SARE_HTML_INV_TAG2     m'\w</?(?!(?:blockquote|optiongroup|plaintext|fontfamily|underline|cf.+))[a-z]{9,17}>\w'
rawbody   __SARE_HTML_INV_TAG3     m'\w<[/!]?(?!cf.+)\w{11,20}>\w'i
rawbody   __SARE_HTML_INV_TAG4     m'\w(?!</?cf.{1,8}>)<[/!]?[bcdfghjklmnpqrstvwxz]{5,9}>\w'i

meta      SARE_HTML_INV_TAG        ( __SARE_HTML_INV_TAG || __SARE_HTML_INV_TAG2 || __SARE_HTML_INV_TAG3 || __SARE_HTML_INV_TAG4 ) && !__CT_TEXT_PLAIN
describe  SARE_HTML_INV_TAG        Message contains invalid HTML tag
score     SARE_HTML_INV_TAG        2.222
#ham      SARE_HTML_INV_TAG        Monotone source code included within body of email
#hist     SARE_HTML_INV_TAG        Combined three invalid-tag rules into one, added \w front and back, to test for
#hist     SARE_HTML_INV_TAG        obfuscation of surrounding text, added tests against __CT_TEXT_PLAIN to give 
#hist     SARE_HTML_INV_TAG        higher scores to HTML email than to plain text email. Enhancements due to 
#hist     SARE_HTML_INV_TAG        ideas suggested by Jesse Houwing, Nicolas Riendeau, and Bob Menschel
#counts   SARE_HTML_INV_TAG        36s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_INV_TAG        5650s/0h of 114422 corpus (81069s/33353h RM) 01/16/05
#counts   SARE_HTML_INV_TAG        8s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_INV_TAG        66s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_INV_TAG        21s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_INV_TAG        386s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_INV_TAG        930s/0h of 38766 corpus (15284s/23482h JH-SA3.0rc1) 09/03/04
#counts   SARE_HTML_INV_TAG        17s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_INV_TAG        0s/0h of 26326 corpus (22886s/3440h MY) 02/15/05
#max      SARE_HTML_INV_TAG        952s/0h of 19469 corpus (16883s/2586h MY) 09/03/04

########  ######################   ##################################################
#   Paragraphs, breaks, and spacings
########  ######################   ##################################################

########  ######################   ##################################################
#  Suspicious tag combinations
########  ######################   ##################################################

rawbody   SARE_HTML_CNTR_TBL       /<center>\s*<table>/im
describe  SARE_HTML_CNTR_TBL       Contains centred table
score     SARE_HTML_CNTR_TBL       1.666
#ham      SARE_HTML_CNTR_TBL       verified (1) 
#hist     SARE_HTML_CNTR_TBL       Tim Jackson, May 25 2005
#counts   SARE_HTML_CNTR_TBL       745s/0h of 333405 corpus (262498s/70907h RM) 05/12/06
#counts   SARE_HTML_CNTR_TBL       1188s/2h of 56024 corpus (51686s/4338h AxB2) 05/15/06
#counts   SARE_HTML_CNTR_TBL       0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_CNTR_TBL       3s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_CNTR_TBL       27s/1h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_CNTR_TBL       0s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_CNTR_TBL       2s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_CNTR_TBL       32s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_CNTR_TBL       57s/0h of 57287 corpus (52272s/5015h MY) 09/22/05

rawbody   __SARE_HTML_SINGLET1     /> [a-z] </i
rawbody   __SARE_HTML_SINGLET2     />[a-z]</i
meta      SARE_HTML_SINGLETS       __SARE_HTML_SINGLET1 && __SARE_HTML_SINGLET2
describe  SARE_HTML_SINGLETS       spam pattern in HTML email
score     SARE_HTML_SINGLETS       1.666
#hist     SARE_HTML_SINGLETS       Robert Brooks, March 2006
#ham      SARE_HTML_SINGLETS       verified (amateur webmaster sample page attached to email)
#counts   SARE_HTML_SINGLETS       26498s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
#counts   SARE_HTML_SINGLETS       3660s/2h of 55981 corpus (51658s/4323h AxB2) 05/15/06
#counts   SARE_HTML_SINGLETS       130s/0h of 13285 corpus (7413s/5872h CT) 05/14/06
#counts   SARE_HTML_SINGLETS       2016s/0h of 155481 corpus (103930s/51551h DOC) 05/15/06
#counts   SARE_HTML_SINGLETS       65s/2h of 42253 corpus (34139s/8114h FVGT) 05/15/06
#counts   SARE_HTML_SINGLETS       5798s/1h of 106183 corpus (72941s/33242h ML) 05/14/06
#counts   SARE_HTML_SINGLETS       20s/1h of 22939 corpus (17232s/5707h MY) 05/14/06

########  ######################   ##################################################
#  Useless tags (tag structures that do nothing) 
#  Largely submitted by Matt Yackley, with contributions by 
#  Carl Friend, Jennifer Wheeler, Scott Sprunger, Larry Gilson
########  ######################   ##################################################

rawbody   SARE_HTML_USL_FONT       m'^<FONT[^>]{0,20}></FONT><'
describe  SARE_HTML_USL_FONT       Another spam attempt
score     SARE_HTML_USL_FONT       0.797
#hist     SARE_HTML_USL_FONT       Loren Wilton Apr 11 2005
#counts   SARE_HTML_USL_FONT       54s/2h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_USL_FONT       5192s/1h of 269462 corpus (128310s/141152h RM) 06/17/05
#counts   SARE_HTML_USL_FONT       0s/0h of 13287 corpus (7414s/5873h CT) 05/14/06
#max      SARE_HTML_USL_FONT       1s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_USL_FONT       0s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#max      SARE_HTML_USL_FONT       9s/0h of 6804 corpus (1336s/5468h ft) 06/17/05
#counts   SARE_HTML_USL_FONT       7s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#counts   SARE_HTML_USL_FONT       32s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_USL_FONT       81s/1h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_USL_FONT       1047s/1h of 57287 corpus (52272s/5015h MY) 09/22/05

rawbody   SARE_HTML_USL_OBFU       m'\w<(\w+)(?: [^>]*)?></\1[^>]*>\w'
describe  SARE_HTML_USL_OBFU       Message body has very strange HTML sequence
score     SARE_HTML_USL_OBFU       1.666
#match    SARE_HTML_USL_OBFU       partialword<tag></tag>restofword
#hist     SARE_HTML_USL_OBFU       Created by Bob Menschel Aug 12 2004
#counts   SARE_HTML_USL_OBFU       393s/3h of 333405 corpus (262498s/70907h RM) 05/12/06
#max      SARE_HTML_USL_OBFU       520s/6h of 196718 corpus (96193s/100525h RM) 02/22/05
#counts   SARE_HTML_USL_OBFU       14s/0h of 9991 corpus (5656s/4335h AxB) 05/14/06
#counts   SARE_HTML_USL_OBFU       0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05
#max      SARE_HTML_USL_OBFU       16s/0h of 10826 corpus (6364s/4462h CT) 05/28/05
#counts   SARE_HTML_USL_OBFU       88s/0h of 42454 corpus (34336s/8118h FVGT) 05/15/06
#counts   SARE_HTML_USL_OBFU       298s/0h of 54067 corpus (16890s/37177h JH-3.01) 06/18/05
#max      SARE_HTML_USL_OBFU       457s/0h of 54283 corpus (17106s/37177h JH-3.01) 02/13/05
#counts   SARE_HTML_USL_OBFU       111s/0h of 105856 corpus (72598s/33258h ML) 05/14/06
#counts   SARE_HTML_USL_OBFU       21s/0h of 23074 corpus (17350s/5724h MY) 05/14/06
#max      SARE_HTML_USL_OBFU       148s/0h of 17145 corpus (14677s/2468h MY) 08/12/04

########  ######################   ##################################################
#   Miscellaneous tag tests
########  ######################   ##################################################

# EOF


